CVE-2026-55186

    Dashboard / Vulnerabilities / CVE-2026-55186

    CVE-2026-55186

    Published: 3 Nov 2026Last Modified: 5 Nov 2026

    Summary: Silverstripe MFA: Can bypass MFA during password reset flow

    Details: Silverstripe MFA provides multi-factor authentication for Silverstripe CMS. Prior to 6.0.0, the CMS 5 password reset flow can issue a logged-in session after a user changes a password but before the user's configured multi-factor authentication challenge is completed. An attacker with access to the user's email account can follow the reset flow and bypass the additional authentication factor. CMS 6 is not affected. This issue is fixed in version 6.0.0.

    References: https://github.com/silverstripe/silverstripe-mfa/releases/tag/6.0.0, https://www.silverstripe.org/download/security-releases/cve-2026-55186, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55186.json, https://github.com/silverstripe/silverstripe-mfa/security/advisories/GHSA-68wq-phq7-p2vg, https://nvd.nist.gov/vuln/detail/CVE-2026-55186, https://github.com/silverstripe/silverstripe-framework/commit/4b5cbd7ddf68721d8119583f0b9c04d4b4adc704, https://github.com/silverstripe/silverstripe-framework/pull/11686, https://github.com/silverstripe/silverstripe-mfa/commit/04a102b662ac2f555acc26f8d2e2d8dab3937a6a, https://github.com/silverstripe/silverstripe-mfa/pull/603

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -42253fbea2edfc39d88202037ab8d24ad97704e3

    Affected versions

    6.0.0-beta1
    6.0.0-alpha1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-55186 | CVE-DB